VULNERABILITY INTELLIGENCE

CVE-2026-44936

CVSS score5 MEDIUM
EPSS probability0.35%
CISA KEVNot currently listed
Published2026-07-06
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Description

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.

Weakness classification

  • meissner@suse.de: CWE-918

Primary references